Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it illegal to impersonate user-agents when you are crawling a website?

If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user impersonating a browser from a different browser(changing user-agent as firefox but making the request from chrome)?

share|improve this question
    
Who knows. Crazy prosecutors argue a lot of weird stuff, and often they get away with it. I believe the fake user agent was considered a point against Auernheimer at his trial. –  CodesInChaos Sep 26 '13 at 10:04
1  
this is solliciting legal advice –  GdD Sep 26 '13 at 10:48
    
How would they prove you faked the agent unless the fake agent was an invalid agent (although you can recompile firefox or chrome ) so then you couldn't prove anything. In other words there is no way to prove you faked an agent. –  Ramhound Sep 26 '13 at 11:21
    
RFC 2616: "[User-Agent] is for statistical purposes, the tracing of protocol violations, and automated recognition of user agents for the sake of tailoring responses to avoid particular user agent limitations." If a server wants to do anything else with it, that's their look-out! –  Graham Hill Sep 26 '13 at 11:57
1  
The laws vary based on the country you are based in! –  micb Sep 26 '13 at 12:15
add comment

closed as off-topic by GdD, Rory Alsop Sep 26 '13 at 11:15

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

It is not illegal here in the US.

I would be wary of seeking legal advise on the internet, especially without giving a specific location. Laws change city to city as they do country to country.

share|improve this answer
    
When weev was recently prosecuted and convicted of "hacking" AT&T's website, the prosecutors kept repeating over and over that his "spoofing" of an iPad (via a forged User-Agent header) was an indication of malicious/devious intent. I'm not sure if those same prosecutors would say such spoofing is outright illegal just on its own, but it was part of what got him convicted, so that should definitely be taken into consideration. –  Anorov Sep 28 '13 at 19:05
add comment

IANAL, but I'd say it depends on the context. I might be considered illegal if you are trying to gain unauthorized access to information by manipulating the user-agent HTTP header. This same principle could also apply to manipulating Cookie HTTP header. In this context, the prosecutor may label it as "hacking" and e-crime.

share|improve this answer
    
There is no way to prove you faked an agent if the agent you faked was a valid agent. –  Ramhound Sep 26 '13 at 11:22
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.